MH17: êàê è êòî?

Èíôîðìàöèÿ î ïîëüçîâàòåëå

Ïðèâåò, Ãîñòü! Âîéäèòå èëè çàðåãèñòðèðóéòåñü.


Âû çäåñü » MH17: êàê è êòî? » Îò÷åòû è äîêëàäû DSB è JIT » Îò÷åò DSB 13.10.15: Crash MH17, 17 July 2014


Îò÷åò DSB 13.10.15: Crash MH17, 17 July 2014

Ñîîáùåíèé 151 ñòðàíèöà 180 èç 280

1

151

ñòð.150

Findings
• Simulations showed that the observed damage and the modelled fragment
pattern resulted in an estimated detonation location of the warhead to the left
and above of the cockpit.
• Simulations demonstrated that the detonation of a 70 kg warhead best matched
the damage observed on the wreckage of the aeroplane.
• The simulations performed indicated that the detonation location of a 9N314M
warhead was in a volume of space that is less than one cubic metre and about
four metres above the tip of the aeroplane’s nose on the left side of the cockpit.
• The damage to the wreckage recovered was consistent with the predictions
made by the simulation of the blast caused by the detonation of a 70 kg warhead.

The above mentioned fndings are consistent with the conclusion of the Dutch Safety
Board that flight MH17 was struck by a 9N314M warhead as carried on a 9M38 series
missile and launched by a Buk surface-to-air missile system.

3.11 The in-flight break-up and its aftermath

3.11.1 Introduction
As part of the failure analysis, the structural fractures of the wreckage pieces were
examined. The purpose of this analysis was to determine whether there was pre-existing
damage that had initiated or contributed to the in-flight break-up. For that purpose
possible fatigue, mechanical damage, corrosion or repairs were looked after. A second
objective was to determine where on the aeroplane the failure had initiated. Descriptions
of types of failure found on the wreckage parts have been included in Appendix L.
Structural fractures at specifc locations were examined, namely the boundaries between
the four main parts of the aeroplane’s structure that have been recovered:
• cockpit and front fuselage;
• centre fuselage;
• rear fuselage;
• tail.
The failure analysis was limited to the wreckage parts that had been recovered.
3.11.2 The separation of the cockpit and front fuselage from the centre fuselage
The cockpit and the front fuselage separated at approximately STA888 from the centre
fuselage. Fractures in the cockpit and the forward fuselage were examined because
these fractures indicate the start of the break-up.
Multiple perforations were present in the cockpit region (i.e. forward of STA236.5). The
left hand side of the cockpit was fractured into small pieces. Therefore, the perforations
had probably acted as crack initiation sites. Due to the presence of these perforations,
the fractures in the cockpit region could not be analysed.

152

ñòð.151

The other main fractures in the front fuselage are shown in Figure 67. These fractures are
numbered (1 up to and including 20).

https://c.radikal.ru/c17/1907/c7/ab0193b7d820.png
Figure 67: Front fuselage left hand side (bottom) and right hand side (top) view with main fracture lines and
                fracture growth directions. The arrows represent the growth direction. The lack of an arrow besides
                (part of) a fracture indicates that the growth direction could not established. Frame locations are
                indicated by STA numbers. (Source: Dutch Safety Board)

The most probable in-flight break-up sequence of the cockpit and front fuselage is
assumed as follows:
Fractures 11 and 12 along STA236.5 can be associated with the initial direct blast wave
due to their proximity to the cockpit and initial blast location. The horizontal fractures at
the level of the passenger floor running aft (fractures 1, 2 and 13), caused a separation of
the top part from the lower part of the front fuselage with the cockpit. The circumferential
fractures at STA655 (fractures 7, 16 and 18) indicate a complete separation of the fuselage
part in front of it.
The fractures in the upper part at STA655 (fractures 7 and 16) propagating upward
indicate an upward bending moment acting on upper front parts and a separation of
upper parts in upward direction. The fractures in the lower part at STA655 (fracture 18)
and on the left hand side between STA529 and STA613 (fractures 5 and 6), propagating
down indicate a downward bending moment acting on the part below the passenger
floor plus cockpit and a separation of these parts in downward direction.

153

ñòð.152

Following this separation, several longitudinal fractures developed in the fuselage part
from STA655 until STA888/909, (fractures 8, 9, 17, 19 and 24) propagating to the rear,
caused radial opening of it and locally peeling of the skin from stringers and frames. The
other fractures between STA655 and STA888/STA909 were consistent with the radial
opening of the fuselage due to aerodynamic loads. Finally this fuselage part separated
from the centre fuselage behind it between STA888 and STA930, see Figure 68.

https://a.radikal.ru/a22/1907/d0/e18822b634b5.png
Figure 68: Observed position of fracture at STA 888/909 and type of loading of the fracture at STA888/909.
                Only between stringers 45R and 39R parts from the front and the centre fuselage ftted together. In
                the fgure the thick line indicates this location. (Source: Dutch Safety Board)

òåêñò ðèñ.68

Unknown
LEFT RIGHT
TOP
Skin peeled off
aft of
STA909 between
and
STA825
at or aft
of STA888
at or aft
of STA888
Looking forward
at or aft
of STA888
Location
unknown
Tension
and
bending
Tension

3.11.3 Separation of the rear fuselage from the centre fuselage
The rear fuselage separated from the centre fuselage at approximately STA1546. This
location coincides with the aft door frame of passenger doors 3L and 3R. The radial
fractures between the centre part and the rear part of the fuselage were consistent with
tensile and bending loading. A large skin panel on the left upper side of the fuselage,
extending from half way the main landing gear wheel bay in front of doors 3L and 3R to
about 1.5 meters aft of doors 3L and 3R, was found at the same location as the parts of
the rear fuselage (in wreckage site number 4). This part probably separated just before
the fuselage rear part broke away. As this part separated, the section at the doors was
weakened.

154

ñòð.153

https://b.radikal.ru/b04/1907/a4/e0c58a4e55f1.png
Figure 69: Examples of tensile overstress fracture at passenger doors 3L and 3R. (Source: Dutch Safety Board)

The weakened fuselage section then broke and the rear part separated.
3.11.4 Separation of the tail from the rear part of the fuselage
The tail separated from the rear part of the fuselage at approximately STA2174. All
fractures investigated here showed signs of out-of-plane bending, mostly combined with
tensile loadings.

https://b.radikal.ru/b12/1907/84/d4f54f2d4517.png
Figure 70: Left hand side separation fracture between rear fuselage and the tail. Separation is at the irregular
                fracture indicated by the black line. The vertical cut through the left letter M was made for
                transportation purposes. (Source: Dutch Safety Board)

155

ñòð.154

3.11.5 Fractures in specifc parts
Also, fractures in a number of specifc parts were examined.
Rear pressure bulkhead
The curved rear pressure bulk head was fractioned and severely deformed. Figure 71
shows the fractures in the dome and the parts that were recovered, namely major
sections with clear intersection with the dome centre part (parts numbered 1, 2, 6 and 8)
and four smaller pieces intersecting with the fuselage structure (parts numbered 3, 4, 5
and 7).
The fractures in circumferential direction followed the intersection with either the
fuselage, or with the tear straps. These fractures are predominantly consistent with a
tensile overstress fracture in the net section. In addition, circumferential fractures were
observed at the connection to the centre part of the dome. Also these fractures surfaces
were consistent with overstress fractures as result of combinations of tension and out of
plane bending. Fractures in a radial direction were observed also consistent with tensile
overstress fractures. These fractures follow the fastener row underneath the radial
stiffeners.

https://b.radikal.ru/b15/1907/a9/dd46d49f6918.png
Figure 71: Fractures in rear pressure bulkhead. Looking aft. The parts that were available for investigation are
                numbered 1 to 8. (Source: Dutch Safety Board)

156

ñòð.155

The fractures observed in the bulkhead were consistent with tensile overstress, caused
either by a pressure difference or a disintegrating fuselage structure, where a relatively
flexible, thin walled dome is pulled apart by the surrounding fuselage structure.
There are no indications of a sudden failure by overpressure of the rear pressure bulk
head.
The observed fracture pattern indicated that most probably the pressure bulkhead was
torn apart by the fuselage breaking up.
Cargo doors
The front cargo door was recovered at wreckage site 3 in closed position. The rear cargo
door had separated from the aeroplane. It was recovered at wreckage site 4. This
indicates it separated relative late in the sequence (of events) with the other parts of the
rear fuselage. It can be ruled out that the opening of the cargo doors contributed to the
crash.
Wing tips
Both wing tips separated from the remaining wing structure. Both ailerons were not
recovered. Fracture patterns led to both a downward acting bending moment and the
likelihood of a relative high torsion moment at the separation area.
Vertical stabilizer
The vertical stabilizer separated from the rear fuselage. Parts of the main frame were
found connected to it. The fractures are consistent with lateral loads acting on the fn
oriented to the aeroplane right hand side, causing a bending moment and a torsion
moment at the connection to the fuselage, resulting in separation of the fn.

https://b.radikal.ru/b15/1907/be/098c5c357714.png
Figure 72: Overload failure of the vertical stabilizer. (Source: Dutch Safety Board)

157

ñòð.156

https://b.radikal.ru/b03/1907/18/1a3da19e66be.png
Figure 73: Fracture separating the vertical stabilizer from the fuselage. Attached skin and broken vertical
               stabilizer-to-fuselage frames bended out of their plane and fractured. (Source: Dutch Safety Board)

Horizontal stabilizers
The horizontal stabilizers had separated from the centre part just outside the fuselage.
Only the centre horizontal stabilizer part and the left hand horizontal stabilizer were
available for investigation. The fractures in the left horizontal stabilizer were consistent
with a downward bending moment acting in the separation plane. This moment was
caused by a downward acting loading on the horizontal stabilizer. Failure of the elevator
attachment brackets and power control units were consistent with high aerodynamic
loads acting on the elevator.
Main landing gear
The Flight Data Recorder data indicated that the main landing gear was in the retracted
position at the last recorded position of the aeroplane. Pictures taken on the crash site a
few days after the crash indicate that the right hand retract actuator of the main landing
gear was close to its retracted (gear-up) length. Therefore it can be concluded that the
landing gear was in the retracted position when the event occurred.

Finding
None of the investigated wreckage parts showed indications of the presence of preexisting damage, such as fatigue, corrosion or inadequately performed repairs.

3.11.6 External damage exacerbated by airworthiness aspects
In paragraph 3.2.2, a number of airworthiness aspects were analysed and excluded as
being the cause of the crash. For completeness, a fnal hypothesis was also considered;

158

ñòð.157

that the aeroplane was not suffciently damaged by surface-to-air missile to cause it to
crash, but that the crash was the result of a combination of the pre-formed fragment
damage and one or more pre-existing technical failures or defciencies.
The comprehensive structural analysis of the failure modes of the fuselage described in
paragraphs 3.11.2 to 3.11.5 showed no evidence of fatigue, pre-existing damage or repairs
that could have played a contributing factor to the crash. None of the systems, as recorded
by the Flight Data Recorder, showed a defect that could have exacerbated the effects of
the damage caused by the high-energy objects. The maintenance records for the aeroplane
following its last major overhaul, in November 2013, did not reveal any defect that had not
been rectifed adequately. None of the deferred defects at the time of the crash could
have exacerbated the effects of the damage caused by the pre-formed fragments.

Finding
The effects of the damage caused by the pre-formed fragments were not
exacerbated by any technical issue.

3.11.7 Ballistic trajectory analysis
3.11.7.1 Introduction
This Section describes the in-flight break-up of the aeroplane, its sequence and the
trajectory after impact.
The distribution of wreckage parts over the crash area given in Section 2.12 shows there
are six wreckage sites numbered 1 through 6. The fgures in Section 2.12 show that the
debris feld can be divided roughly in two areas: one (sites 1, 2 and 3) relatively close to
the last recorded FDR position, and one (sites 4, 5 and 6) relatively close together and
further from that position and more or less in the direction of flight.
As the wreckage sites 1, 2 and 3 are much closer than the sites 4, 5 and 6 to the last FDR
position, it may be concluded that the wreckage parts which landed there separated
much earlier from the aeroplane than those in sites 4, 5 and 6. The sites 4, 5 and 6 being
relatively close together suggests that the time intervals between the separation of these
parts from the aeroplane must have been relatively short and that the altitudes of
separation were relatively low.
The previous sections give the results of the investigation into the main fractures in the
structure and the separations of different aeroplane parts.
Figure 67 shows left and right side views of the front fuselage with the main fractures in
the aeroplane structure.

159

ñòð.158

As mentioned elsewhere in this report, no radar fxes or eye-witness statements on the
moment of the in-flight break-up were available. As a result, the information available to
make a reliable reconstruction of the flight path and the break-up sequence is limited.
Only information from distribution of debris over the six wreckage sites is available.
To obtain information about the moment of separation of some wreckage parts at a
certain moment, a ballistic trajectory analysis was carried out.
A ballistic trajectory analysis can be used to determine the trajectory through the air of an
object that has no aerodynamic lift. Its trajectory is determined by its ballistic coeffcient
(BC), which is the weight of an object divided by the product of its drag coeffcient with its
cross-sectional area. Thus a feather (which has a very low ballistic coeffcient) would fall
slowly when released from an initial point in space, moving almost exclusively with the
wind to the ground. In contrast, a bowling ball (which has a high ballistic coeffcient) would
fall rapidly, with very little displacement resulting from the wind.
A ballistic trajectory analysis was performed for selected wreckage parts recovered on
the ground, with known starting conditions; the last recorded FDR position and time,
flight altitude and airspeed. Using the known wind speed and directions from the ground
until the cruise altitude, it was possible to determine the trajectories and thus the landing
locations. More information about the method of ballistic trajectory analysis is found in
Appendix K.
3.11.7.2 Results of the ballistic trajectory analysis
A ballistic trajectory analysis was performed for parts, with the following starting
conditions: last known FDR position, time of last FDR recording, speed and altitude,
taking into account the reported wind from cruise level to the earth.
By running the ballistic trajectory analysis for multiple ballistic coeffcients, a so-called
locus line was obtained. The locus line represents the possible ground positions of
wreckage parts after break-up, assuming that they all separated at the same initial
position, altitude and speed and assuming a ballistic trajectory taking into account the
wind, see Figure 74.

160

ñòð.159

https://d.radikal.ru/d22/1907/35/837cec55d973.png
Figure 74: Calculated locus line (black) from ballistic trajectory analysis with identifed wreckage and cargo
                parts in sites 1, 2 and 3. (Source: Dutch Safety Board)

òåêñò ðèñ.74

Sites 1, 2 and 3
Legend
Road
Residential area
Railway
Wreckage location
Locus line
Textile roll location
Site 1
1. Upper left hand cockpit fuselage*
2. Upper part fuselage above business
class (forward)*
3. Upper part fuselage above business
class (aft)*
4. Right hand fuselage with partial text
“Malaysia”
5. Left hand fuselage with positive
pressure relief valves*
Site 2
6. Left hand fuselage with door frame of
door 1L*
7. Right hand fuselage with door frame of
door 1R*
8. Left hand fuselage with door frame of
door 2L
9. Lower fuselage with forward cargo floor
10. Right hand fuselage with door 2R
11. Left engine intake ring
12. Left hand fuselage with impact damage
13. Forward section passenger floor,
business class
Site 3
14. Cockpit, including forward bulkhead,
forward cargo hold, nose gear wheel
bay, avionics
* Parts not retrieved by the Dutch Safety
Board

From the cargo manifest it was established that ten textile rolls were transported on a
pallet with position 21P (approximately STA700 - STA800); see Section 2.12. These textile
rolls, once separated from its pallet, would have had a very low ballistic coeffcient. From
satellite imagery seven textile rolls, each containing 100 metres of textile, were identifed
in site 1 approximately 5 to 5.7 kilometres from site 3 (cockpit). It is of note that the
textile rolls were identifed on a satellite image dated 21 July 2014. Satellite imagery after
this date did not show the textile rolls, but showed clear markings of agricultural work.
In Appendix K, the Ballistic Coeffcients of the textile rolls were calculated and they were
as expected very low. This would mean that they would likely be found near the top end
of the locus line if they separated from the aircraft at the point of initial break-up. As site
1 is at the top end of the locus line where low Ballistic Coeffcient pieces would be
expected, this verifes the ballistic locus line calculation

161

ñòð.160

The combination of the cockpit with the lower fuselage part has a very high ballistic
coeffcient. This means it would likely be found near the lower end of the locus line if it
separated from the aircraft at the point of initial break-up, and that is where it was found
(site 3).
All parts from the fuselage part in front of STA888/909 that were recovered, were found
in the sites 1, 2 and 3, at or very close to the locus line.
Thus, it can be concluded that all the pieces of wreckage from the fuselage part in front
of STA888/909, recovered from the sites 1, 2 and 3, separated from the aeroplane in the
frst few seconds after the impact of the high-energy objects.
All aeroplane parts of the fuselage aft of STA888/909, wings and empennage were found
in sites 4, 5 and 6. These sites are located relatively far beyond the locus line. From this it
can be concluded that these parts separated from the aeroplane much later than those
of the forward fuselage.
3.11.8 Break-up of the aeroplane
After the impact of the high-energy objects the aeroplane broke up in the air: There are
two distinct phases in relation to the in flight break-up; the break-up of the front fuselage
and the centre/rear fuselage. These are described in the paragraphs below.
3.11.8.1 Break-up of the front fuselage
The front fuselage broke into the following three main components:
• the damaged cockpit with a large part of the lower fuselage with the passenger floor
in front of STA655;
• large parts of the fuselage above the passenger floor, in front of STA655;
• the cylindrical fuselage part between STA655 and STA888/909.
Within approximately one second the fuselage top parts in front of STA655, above the
passenger floor, were bent upward, while the fuselage lower part in front of STA655, was
bent downward. This was followed immediately by the fuselage part behind it, bending
radially outward and separating behind the doors 2L and 2R at (STA 888/909).
All recovered parts from the fuselage in front of STA888/909, were found on or very
close to the locus line. This indicates that the break-up sequence of the forward part of
the aeroplane took place immediately after the last FDR recording, and lasted in the
order of seconds.
3.11.8.2 Break-up of the centre and rear fuselage
The separation of the forward fuselage resulted in signifcant changes to the mass and
balance and aerodynamic characteristics or the aeroplane, substantially modifying its
flight characteristics.
The centre of gravity moved aft, probably behind its rear certifed limit, probably causing
longitudinal instability of the aeroplane. Further, the aerodynamic loads that would
normally result from the air impacting and flowing over the smooth forward fuselage

162

ñòð.161

were replaced by the loads created by air impacting and flowing over the blunt open,
damaged fuselage, which resulted in increased drag and altered airflow over the inboard
sections of the wings.
Despite having no radar data available for trajectory analysis, a general sequential outline
of the break-up sequence can be established using wreckage location information in
combination with the analysis of fractures between the structural parts. As mentioned
before, as no post-crash radar fxes or eye-witness declarations were available, it is not
possible to make an accurate reconstruction of the break-up sequence.
The fact that no wreckage pieces from behind STA909 were found in site 1 through 3
suggests that after the front part of the aeroplane broke up and separated, the remainder
of the aeroplane continued flight for some time along an undetermined path.
In a relative short time interval, the two wing tips, the stabilizers, the fuselage behind
STA 1546.5, inclusive of most parts of the rear pressure bulkhead, separated from the
centre fuselage and hit the ground in site 4. The centre fuselage section with the
remainder of the wings and engines continued their flight for some time as they were
located in site 6. Later in time, the fuselage part aft of STA 1546.5 broke near the rear
pressure bulkhead. The main parts behind it, the vertical fn, the centre stabilizer torsion
box and the damaged tail cone landed very close together at site 5.
In site 4 several textile rolls were identifed on satellite imagery and were, later on,
recovered from the site. From the cargo manifest it was established that 10 textile rolls
were transported in a container in the aft cargo compartment located at position 33L.
The textile rolls were found in close proximity of (500 metres) or on top of other wreckage
pieces. The textile rolls possessed a very low ballistic coeffcient.
The parts found in sites 4 had big differences in Ballistic Coeffcients and they were found
in close proximity. This suggests the break-up in this site was at a much lower altitude
and thus later in the break-up sequence than the frst break-up.
This is furthermore substantiated by the wreckage area footprint and spread of the
wreckage pieces in sites 4 through 6. For sites 4 through 6 the maximum range the
wreckage pieces are spread is approximately 1.5 kilometres from the main impact point
in site 6; this is substantially less than the wreckage spread of 7 kilometres for sites 1
through 3. In site 4 the left and right wing tip were located but the remainder of the left
and right wings were found in site 6.
Also the left and right horizontal stabilizers were found in site 4. The left stabilizer was
found on the right hand side of the expected flight track, the right stabilizer on its left
side. This suggests that at this point the aeroplane may have been inverted. The stabilizer
centre torsion box was found in site 5. This suggests that the stabilizers separated at the
same moment as other parts found in site 4, while the aft tail section continued its flight
for a short time.

163

ñòð.162

In site 5 the vertical fn was located and in close proximity parts of the tail section. The
crew bunk container, located in the aeroplane aft cargo compartment (hold 31 and 32),
was located in site 5.
Other cargo items from load positions 41 to 44 (See Appendix E) were found spread over
sites 4 and 5. These items were found in reverse, meaning that the items that originate
from the left hand side of the aeroplane were found predominantly on the right hand
side of the expected flight track and vice versa. This combined with other wreckage
pieces suggest that at this point the aeroplane may have been inverted.
In site 6 a fuselage part just in front of passenger door 3R was found under the aeroplane
keel beam structure together with a part of the lower fuselage, normally located just in
front of the centre wing. This suggests that the centre fuselage with the remainder of the
wings and engines was in an upside down position by a rotation around the lateral axis,
and thus moving in a rearward direction, during impact with the ground. Both wings
were found separated from the mid centre section, up-side down in site 6. The engines
did not separate in the air as both engines were found in site 6 in close proximity of their
respective wing positions. However, the left engine intake ring was found in site 2. This
indicates an earlier separation in time of that part.
With the available information the conclusion can be drawn that after separation of the
front fuselage, the centre and aft fuselage sections with the complete wings continued
flying, and then after a short time interval the wing tips broke off and the aft fuselage
section and tail separated. Thereafter the aft fuselage section may have rolled inverted
when the stabilizers separated, and later the damaged tail section, with the vertical fn
and the stabilizer centre torsion box, separated near STA2150. These parts landed closely
together. From the wreckage pattern it can be seen that this would have been at a low
altitude. The centre fuselage fnally landed in an inverted position after a rotation around
its lateral axis.
The time interval between the separation of the front fuselage and the moment that the
remainder of the aeroplane impacted the ground is estimated to have been 1-1.5 minutes.

164

ñòð.163

Findings
• From the ballistic trajectory analysis it can be concluded that all the pieces of
wreckage from the fuselage parts in front of STA888/909 departed the aeroplane
immediately after the last Flight Data Recorder recording.
• It also indicated that all debris recovered from the other three sites (4, 5 and 6),
departed the aeroplane later, as their location in the debris feld was relatively far
beyond the locus line.
• After separation of the front fuselage, the remainder of the fuselage with the
complete wings continued its flight.
• After a short time interval the wing tips broke off and the aft fuselage section
with the tail separated.
• Thereafter the aft fuselage section may have rolled inverted when the horizontal
stabilizers separated, and later the damaged tail section, with the vertical
stabilizer and the stabilizer centre torsion box, separated near STA 2150.
• The centre fuselage fnally landed in an inverted position after a rotation around
its lateral axis.
• The time interval between the separation of the front fuselage and the moment
that the remainder of the aeroplane impacted the ground is estimated to have
been 1-1.5 minutes.

3.12 Passenger oxygen system

The cabin pressure altitude recorded on the Flight Data Recorder, described in Paragraph
2.18.2, was 4,800 feet during cruise up to the moment that the recording stopped at
13.20:03 (15.20:03 CET). The recording stopped due to electrical power interruption as
analysed in Paragraph 3.4.3. Therefore, the passenger oxygen system was probably not
activated prior to this moment.
The perforation of the aeroplane’s structure caused the cabin of the aeroplane to
depressurise and a cabin altitude of 13,500 feet was exceeded. Had electrical power
been available, the passenger oxygen masks would have been automatically deployed.
According to the aeroplane manufacturer, when depressurisation occurs the deployment
of the masks may take a few seconds, in part as the electrical signal is delayed to avoid
false deployment. Therefore, the loss of electrical power prevented the system-activated
deployment of the passenger emergency oxygen masks.
On the oxygen generators recovered from sites 4 and 5, some solenoid switches were
deformed and the latches had separated from all of the recovered containers. It is
therefore considered likely that oxygen masks dropped out of the passenger service unit
containers due to torsion or other forces upon these containers. This would then result in
the unlocking or separation of the latches. This could have been the result of either the
blast of the warhead explosion, the effects of the in-flight break-up or the impact with
the ground.

165

ñòð.164

It requires a force of only a few Newton*20 to remove the fring pin from the oxygen
generator. Therefore, it is conceivable that the oxygen generators were fred as a result
of the blast, the dynamic forces during the in-flight break-up or the impact with the
ground. The oxygen generator which had not been fred, originated from the crew rest
area. It is considered possible that the rest area, a closed container, may have been
better protected against the dynamic forces during the in-flight break-up or from the
impact with the ground.

https://c.radikal.ru/c19/1907/49/01a9a527eb4f.png
Figure 75: One of the recovered passenger oxygen generators. (Source: Dutch Safety Board)

òåêñò ðèñ.75

Black coloured stripe when
fred; yellow when not fred.

The flight crew’s emergency oxygen supply is a different system to that in the cabin.
Information on the flight crew system could not contribute to the analysis of the cabin
pressure or cabin oxygen supply system.

Findings
• It is considered unlikely that the passenger oxygen masks were deployed before
the electrical power supply was interrupted. It is unlikely that the passenger
oxygen system was activated in the normal way.
• It is likely that passenger oxygen masks dropped down because the passenger
service unit container latches opened or separated. This occurred as a result of
the forces exerted upon these latches due to blast, the dynamic forces during
the in-flight break-up or the impact with the ground.

3.13 Recovery and identifcation of victims flight MH17
Given the circumstances, the recovery and transporting of the human remains were
carried out with the greatest possible care. The recovery method adopted during the
frst few days after the crash allowed a substantial number of the victims to be identifed
reasonably quickly. At the time of the report’s production, two of the 298 occupants had
not been identifed.
---------------------------------------------------------------------------------------------------
*20 For reference see Federal Aviation Administration specifcation TSO-C64.

166

ñòð.165

Finding
296 of the 298 occupants of flight MH17 were identifed at the time of the publication
of the Final Report.

3.14 Survival aspects
The investigation revealed that the occupants were confronted with the effects of the
missile’s impact in different ways. The effects were partly determined by the location in the
aeroplane where they found themselves when the warhead detonated. The impact of
missile fragments and the subsequent pressure wave caused the aircraft to break up. This
impact was only instantly fatal to the occupants of the cockpit. The other occupants were
almost immediately exposed to factors that had an extreme impact on the body and which
were not the same for everyone. There was the deafening noise of the impact, abrupt
deceleration and acceleration, decompression and the corresponding mist formation,
reduced oxygen level, extreme cold, powerful airflow, the aeroplane’s rapid descent and
objects flying around.*21 As a result, some occupants suffered serious injuries that probably
caused their death. In others, the exposure led to reduced awareness or unconsciousness
in a very short space of time. It was not possible to ascertain the time at which the
occupants died; it was established that the impact on the ground was non-survivable.
It cannot be ruled out that some occupants remained conscious for some time during the
one to one and a half minutes for which the crash lasted. The Dutch Safety Board deems
it likely that the occupants were barely able to comprehend the situation in which they
found themselves.*22,*23,*24,*25,*26,*27 The Dutch Safety Board does not deem it likely that the
occupants performed conscious actions after the impact.*28,*29 No indications were found
that point to any conscious actions. No photographs or (text) messages from occupants
were found on personal data carriers such as mobile phones that were taken after the
impact. Such messages and photographs were found after several other aircraft crashes.
There may have been reflexive actions such as clutching the armrests of the seat. See
Appendix N for more information.
----------------------------------------------------------------------------------------------------------------------------------------------------
*21 See Appendix N: Background to Passengers Exposure.
*22 Guyton, A.C., J.E. Hall, Textbook of Medical Physiology, Chapter 60. The Autonomic Nervous System and the
Adrenal Medulla, 2006.
*23 Baddeley, A. D., G. Hitch, ‘Working memory’, in G.H. Bower (Ed.), The Psychology of Learning and Motivation:
Advances in Research and Theory, Vol. 8, 1974, 47-89.
*24 Ehlers, A., D.M.Clark, ‘A Cognitive Model of Post-traumatic Stress Disorder,’ Behaviour Research and Therapy,
38(4), 2000, 319-345.
*25 Roediger, H. L., ‘Implicit memory: Retention without Remembering’, American Psychologist, 45, 1990, 1043-1056.
*26 Dalgleish, T., ‘Cognitive Approaches to Post-traumatic Stress Disorder: The Evolution of Multirepresentational
Theorizing,’ Psychological Bulletin, 130(2), 2004, 228-60.
*27 Qin, S., E.I., Hermans, H.I.F Van Marle, I. Luo, G. Fernández, ‘Acute Psychological Stress Reduces Working Memoryrelated Activity in the Dorsolateral Prefrontal Cortex’, Biological Psychiatry, July 1;66(1), 2009, 25-32.
*28 A retrospective study by Leach (2004), based on offcial research reports and written testimonies from various
maritime and aviation disasters, reveals that freezing is a common response among people in serious emergency
situations.
*29 Leach, J., ‘Why People ‘Freeze’ in an Emergency: Temporal and Cognitive Constraints on Survival Responses’,
Aviation, Space, and Environmental Medicine, 2004. 539-542.

167

ñòð.166

During the process to identify the victims, one passenger was found with an oxygen
mask around the neck. It is unclear how the mask got there. The traces the NFI found
during the forensic examination were not suitable for constructing a DNA profle, thus it
remains unclear whether the person concerned put on the mask in a reflex or that it was
done by someone on the ground after the passenger’s death.

Findings
• The numerous injuries resulting from perforation of the pre-formed fragments
after detonation of the warhead immediately killed the three crew members in
the cockpit.
• There were no pre-formed fragments found in the bodies of the other occupants.
As a result of the impact, they were exposed to extreme and many different,
interacting factors: abrupt deceleration and acceleration, decompression and
associated mist formation, decrease in oxygen level, extreme cold, strong airflow,
the aeroplane’s very rapid descent and objects flying around.
• As a result, some occupants suffered serious injuries that were probably fatal. In
others, the exposure led to reduced awareness or unconsiousness within a very
short time. It was not possible to ascertain at which moment the occupants died.
The impact on the ground was not survivable.
• The Dutch Safety Board did not fnd any indications of conscious actions
performed by the occupants after the missile’s detonation. It is likely that the
occupants were barely able to comprehend the situation in which they found
themselves.

3.15 Recording of radar data

During the investigation, the Russian Federation declared that the requirement to store
surveillance radar data only relates to Russian Federation territory. As flight MH17 crashed
outside this territory, according to the Russian Federation, there was no requirement to
retain data of flight MH17. However, the ICAO requirements in paragraph 6.4.1 of Annex
11 make no distinction about the geographic limitation regarding the storage of data
and they imply that all data shall be recorded. This means that there was a requirement
to store all radar data, both raw and processed data, regardless of state bounderies.
The extract of the Russian Federation’s national requirements supplied to the investigation
does not mention a distinction about the geographic limitation regarding the storage of
data. The automatic recording of radar data by the Russian Federation differs from the
ICAO standard. When a State cannot, or will not, follow the provisions of an ICAO
standard, ICAO requires that the difference between the national version of a specifc
standard and ICAO’s text be reported to ICAO. The obligation to make such a notifcation
arises from Article 38 of the Convention on International Civil Aviation.
Based on the information available, it cannot be concluded that a difference exists
between the Russian Federation’s requirements and the ICAO standard in this matter.

168

ñòð.167

However, the Russian Federation did not provide the radar data to the investigation that
it was required to provide according to the requirements of paragraph 6.4.1 of Annex 11.

Findings
• According to the Russian Federation, its requirements for automatic recording
and retention of radar data only relate to Russian Federation territory. The extract
of the requirements provided by the Russian Federation did not mention a
distinction about geographic limitations regarding the storage of data.
• The ICAO standard in paragraph 6.4.1 of Annex 11 makes no distinction about
the geographic limitation regarding the storage of data; all radar data shall be
recorded.
• The Russian Federation did not comply in all respects with the ICAO standard
contained in paragraph 6.4.1 of Annex 11

169

ñòð.168

PART B: Flying
over conflict zones

This part of the report focuses on the
investigation into the flight route of flight MH17
on 17 July 2014 and the decision-making related
to flying over conflict zones.

170

ñòð.169

PART B: FLYING OVER CONFLICT ZONES

Introduction to Part B                                                                                   170
4 Decision-making related to flight routes - the system                                   171
5 The situation in the eastern part of Ukraine and signals for civil aviation         177
6 Flight MH17 on 17 july 2014 - Ukraine’s management of the airspace             191
7 Flying over Ukraine: what did Malaysia Airlines and others do?                       211
8 The state of departure of flight MH17 - the role of the Netherlands                 231
9 Assessing the risks pertaining to conflict zones                                             244

171

ñòð.170

INTRODUCTION TO PART B

This Part of the report deals with the flight route of flight MH17 on 17 July 2014 and the
decision-making process about flight routes above conflict areas.
The key questions are:

• How and why were decisions made to use MH17’s flight route?
• How is the decision-making process related to flying over conflict zones generally
organised?
• What lessons can be learned from the investigation to improve flight safety and
security?

Part B consists of six Sections:
• A description of the system of responsibilities of parties involved;
• Indicators related to the situation in the eastern part of Ukraine in the months prior to
the crash of flight MH17;
• The airspace management by Ukraine in the period up to and including 17 July 2014;
• The route and flight operations of flight MH17, the decisions made by the airline,
Malaysia Airlines, and the decisions made by other airlines and other states with
regard to flying over the conflict area in the eastern part of Ukraine;
• The role of the Netherlands, as the state of departure of flight MH17, with regard to
flying over conflict areas;
• Risk assessment related to flying over conflict zones.
Part B relates to part A in the following manner:
• In Section 2.1 (part A), flight MH17 is introduced: the flight plan and the actual conduct
of the flight. In Section 7.2 (Part B), this is further elaborated.
• In Section 2.9 (part A), Air Traffc Management is introduced. In Section 6 of part B,
this is further elaborated.
After the crash of flight MH17, various actions were taken to make flying over conflict
areas safer. Appendix P provides an overview. Where relevant, these are also mentioned
in the report itself.

172

ñòð.171

4 DECISION-MAKING RELATED TO
FLIGHT ROUTES - THE SYSTEM

4.1 Introduction

This Section describes the tasks and responsibilities of the parties involved in the safety *30
of civil aviation airspace. A detailed overview of the regulations relevant to this part of
the investigation and of the parties involved is included in Appendix Q. The second part
of this Section is devoted to the frame of reference adopted by the Dutch Safety Board
for this part of the investigation. The Dutch Safety Board analysed the investigation’s
fndings on the basis of regulations as well as on its own frame of reference.

4.2 States’ and operators’ responsibilities *31

Figure 76 illustrates schematically how the responsibilities related to the use of existing
flight routes are organised. The parties concerned are:
1. The state that manages the airspace;
2. Airline operators;
3. States in which those operators are based.

https://a.radikal.ru/a16/1907/d3/529f4f9e6aeb.png
Figure 76: Responsibilities in the decision-making process related to airspace usage. (Source: Dutch Safety Board)

òåêñò ðèñ.76

Airspace restricted:
no flying
Airspace open:
flying permitted
State of operator
prohibits: no flying
Operator:
further assessment
No flying
Sovereign state
Flying

--------------------------------------------------------------------------------------------------------------------------------------
*30 Safety is meant here in the broad sense of the word and entails both safety and security. See also Abbreviations
and Defnitions.
*31 Responsibilities arising from provisions in the Convention on International Civil Aviation.

173

ñòð.172

4.2.1 States’ responsibilities

4.2.1.1 The state that manages the airspace
Each state has sovereignty over the airspace over its territory. This means that the
relevant state exercises complete and exclusive control over its own airspace.*32 States
enter into mutual agreements to open their airspace to operators from other states.*33 For
reasons of safety, a state may impose limitations on the use of its airspace and determine
along which routes and at which minimum altitude aircraft may fly within that airspace.
The managing state can also partly or fully close its airspace if this is necessary for safety
reasons.*34 Due to its sovereignty, however, a state cannot be compelled to do so.
In the State Safety Programme (SSP), the state describes how policy, regulations,
permitting processes and monitoring are organised.*35 A state should ensure a safety
level of the airspace that it has chosen. Although it is not explicitly established anywhere
that the manager of the airspace must guarantee the safety of the relevant airspace,
ICAO documents reveal that this is expected of states. The introduction to Doc 9554-
AN/932*36 stipulates that ‘The common use by civil and military aviation of airspace and of
certain facilities and services shall be arranged so as to ensure the safety, regularity and
effciency of international civil aviation’. From this one can deduce that the state must
make all reasonable attempts to ensure the safety of the airspace, specifcally in case of
common use by civil and military aviation. Circular 330 AN/189, which offers guidance on
the joint use of airspace by civil and military aircraft, also states: ‘Obligations of ICAO
Member States under the Chicago Convention germane to civil/military issues include:
a. Rule-making as regards aviation safety rules in compliance with ICAO SARPs contained
in the Annexes to the Convention (Article 37);
b. Carrying out tasks which pertain to, for instance, ATM and which are laid down in the
Annexes to the Convention, such as the classifcation of airspace and coordination
between civil and military air traffc.’
Moreover, paragraph 10.3 of Doc 9554-AN/932 states that the state responsible for air
traffc services should, on the basis of available information, determine the geographical
conflict area and assess the dangers or possible dangers to civil aviation. Based on the
assessment, the state should decide whether the operation of civil aircraft should be
avoided in or through the conflict area or could be allowed to continue under certain
conditions. In the latter case, the state should publish an international NOTAM with the
necessary information, recommendation and safety measures to be taken and update
this on the basis of any developments.*37
-----------------------------------------------------------------------------------------------------------------------------------------
*32 Convention on International Civil Aviation, ICAO Doc 7300/9, Paragraph 1.
*33 Airlines from other states need an overflight permit (Convention on International Civil Aviation, ICAO Doc 7300/9,
Article 6). The permit specifes that the airline pays an overflight charge to the state managing the airspace. The
costs are worked out in an agreement that arises from article 6.
*34 Convention on International Civil Aviation, ICAO Doc 7300/9, Article 9. This includes the activities a state shall
undertake to ensure an acceptable safety level. Here it involves activities related to Annexes 1, 6, 8, 11, 13, 14 and 19.
*35 Convention on International Civil Aviation Annex 19, Paragraph 3.1.1.
*36 Doc 9554 has a recommending function and is not binding.
*37 ICAO is currently updating Doc 9554. It should be completed in 2015.

174

ñòð.173

Although the Chicago Convention exclusively pertains to civil aviation, it does state the
importance of military aviation and the necessary coordination.*38 Authorities relevant to
the provision of air navigation services should work closely with military authorities, who
are responsible for activities that could influence civil aviation. Civil and military air traffc
service providers should make coordination agreements for the immediate exchange of
information relevant to a safe flight operation. This coordination aims to reduce the
threats resulting to civil aviation as a result of military activities as much as possible.*39
States use NOTAMs to publish information concerning the establishment, condition or
change in any aeronautical facility, service, procedure or hazard, the timely knowledge of
which is essential to personnel concerned with flight operations’.*40 States publish this
information in addition to or as a supplement to the Aeronautical Information Publication
(AIP *41). The provision of this aeronautical information aims to make the necessary
information available to everyone involved in flight operations and air navigation
services.*42 Many states, including Ukraine, have allocated this task to the air navigation
service provider.
4.2.1.2 State of operator *43
The aviation authorities of some states have the legal power to prohibit operators, other
aviation companies and pilots to whom they have issued a permit or certifcate, from
flying in the airspace of another country, or to impose a restriction on a foreign airspace.*44
States can also advise or inform its ‘own’ operators about potential risks. This role of
states will be addressed further in Sections 7, 8 en 9.
4.2.1.3 Other relevant state responsibilities
The responsibilities cited above relate mainly to airspace management. In addition,
Annex 17 of the Chicago Convention contains Standards and Recommended Practices
for aviation security. The state shall have as its primary objective the safety of passengers,
crew, ground personnel and the general public in all matters related to safeguarding
against unlawful interference in civil aviation.*45 ICAO sees the destruction of an aircraft in
service as an example of unlawful interference.*46 Where necessary, states shall take
action to maintain aviation security at the desired level.*47 If they possess threat-related
information, authorities shall, insofar as is possible and relevant, share it with other
states.*48
-------------------------------------------------------------------------------------------------------------------------
*38 Convention on International Civil Aviation, ICAO Doc 7300, Article 3 (d).
*39 Convention on International Civil Aviation Annex 11, Paragraph 2.18.
*40 Convention on International Civil Aviation Annex 15, Aeronautical Services, Chapter 2.
*41 An AIP is a publication issued by a state’s aviation authority. It contains aeronautical information of a lasting
character that is essential for air navigation. It contains details related to legislation, procedures and other
information that is relevant to aircraft flying in the state concerned. AIPs contain more permanent information,
whereas NOTAMs pertain to short-term or temporary situations.
*42 ICAO Annex 15, Paragraph 3.1.6. There is also the Aeronautical Information Circular (AIC). See Appendix Q, which
explains all these forms of information provision.
*43 Airlines are based in states. Aircraft are included in an aviation register. The state in which the aircraft is registered
is responsible for supervising its airworthiness.
*44 This applies, for example, to the US and the UK. These states have national regulations that makes this possible.
The ICAO framework provides room for this, but does not impose any obligation on states to assume their
responsibility for the safety of their own nationals respectively the operators established in these states.
*45 ICAO Annex 17, Paragraph 2.1.1.
*46 ICAO Annex 17, Chapter 1, defnition of ‘acts of unlawful interference’.
*47 ICAO Annex 17, Paragraph 3.1.3.
*48 ICAO Annex 17, Paragraph 2.4.3.

175

ñòð.174

ICAO Member States shall use a national aviation security programme for aviation
security. In accordance with Annex 17, such a programme exclusively applies to the
security of the state’s own aviation infrastructure.
Risks related to the use of foreign airspace are not specifcally addressed in Annex 17.
This does not, however, preclude states from conducting risk assessments of foreign
airspace, as appropriate.
A state can request its operators to take additional security measures when operating
specifc flights in the airspace of other states.*49 The state shall also possess systems for
monitoring requirements related to aviation security.*50
4.2.2 Operators’ responsibilities
Operators determine which flight routes they use in the available airspace and perform
their own assessments when opting for a particular flight route. These may be
considerations of aviation safety, but also concern the aeroplane and costs. The
responsibility for safe flight operations is also cited in Annex 6 of the Chicago
Convention.*51 In accordance with the aforementioned Annex 17 of the Chicago
Convention, states shall require its commercial air transport operators to have in place a
written operator security programme that satisfes the requirements of the National Civil
Aviation Security Programme of the state concerned.*52 Combined with the provisions in
Annex 19, they are required to have and use a safety management system as well as a
security programme.*53 Annex 17 includes provisions for operators mainly related to the
security at aerodromes or in the aeroplane. The security of flight routes in foreign
airspace is not part of the provisions in Annex 17.
If a particular foreign airspace is not closed or restricted, and the state in which an
operator is based has not issued an overflight prohibition or restriction that applies to
this particular airspace, it is the operator that decides whether to use that airspace or
not. This means that operators have a responsibility to determine whether a flight route
is safe enough to be used. Operators can use various information sources, such as public
sources, sources from the government of the state in which they are based, external
consultants, other operators and its own personnel. The latter also includes staff
specifcally charged with security aspects.
The aircraft captain is responsible for ensuring that flights are operated in accordance
with aviation regulations as included in ICAO Annex 2.*54 This also covers flight
preparation.*55 ICAO does not specifcally mention the assessment of safety and security
aspects related to airspace and flight route. ICAO anticipates a role for the operator as
-----------------------------------------------------------------------------------------------------------------------------------
*49 ICAO Annex 17, Paragraph 2.4.1.
*50 ICAO Annex 17, Paragraph 3.4 - Quality Control.
*51 Convention on International Civil Aviation Annex 6, part I, Aeroplanes, Paragraph 4.1.
*52 Annex 17 of the Chicago Convention affords states room for a broad interpretation in which risks to foreign flight
paths are also part of the National Security Plan, but the elaboration in the ‘Aviation Security Manual’ illustrates
that such a broad interpretation is uncommon.
*53 ICAO Annex 19, Safety Management, Paras 3.1.3 and 4.1 and ICAO Annex 17, Paragraph 3.3.1.
*54 Convention on International Civil Aviation Annex 2, Rules of the Air, Paragraph 2.3.1.
*55 Convention on International Civil Aviation Annex 2, Paragraph 2.3.2.

176

ñòð.175

well as the captain if there is a sudden outbreak of armed violence.*56 On this matter
ICAO states that, once the usual coordination processes between civil and military
authorities are no longer followed due to a sudden outbreak of violence, the operators
and the captain must assess the situation, using the information available to them, and
take action so as not to jeopardise safety.*57
4.2.2.1 Code sharing *58
Many operators use code sharing as a marketing tool and generate additional revenues
that way. It involves two or more operators offering seats under their own names on a
single flight operated by one of these operators. This makes it possible, for example, for
an operator to offer destinations to which it does not fly itself. The operator with which
the tickets are booked is obliged to inform passengers about the operator that will
actually be operating the flight concerned.
Flight MH17 used code sharing: KLM sold seats on flight MH17 under its own name.
When code sharing, the operator that actually operates the flight bears responsibility for
passenger safety during the flight.
There are no binding ICAO requirements related to code sharing. ICAO Annex 17 does
however recommend that a state requires its operators to inform the appropriate
authority about their code sharing arrangements to the aviation security in the state
where it is based. ICAO stipulates that when authorising a code share agreement, the
state shall consider public interests and shall assess whether operators satisfy relevant
international safety standards.*59 ICAO does not specify which interests and standards are
relevant.
4.3 Frame of reference
In its investigation the Dutch Safety Board uses a frame of reference. This consists, on
the one hand, of the applicable laws and regulations and, on the other hand, on the
Dutch Safety Board’s view on management of safety risks that is as effective as practically
possible.
Flying is an important mode of transport and a vital part of contemporary society.
Passengers ought to be aware that flying involves risks. The chance of a crash in aviation
is small, but the consequences of such a crash can be signifcant.
It is very diffcult for passengers to independently gather suffcient information about the
risks of flight routes. Therefore they cannot - or virtually cannot - assess independently
whether a route is suffciently safe, also because flight routes can change right up to the
last moment and even during a flight.
---------------------------------------------------------------------------------------------------------------------------------
*56 In ICAO Doc 9554, the Manual Concerning Safety Measures Relating to Military Activities Potentially Hazardous to
Civil Aircraft Operations.
*57 ICAO Doc 9554, Paragraph 3.1.1. Also refer to Appendix Q.
*58 Code sharing is explained in more detail in Appendix Q.
*59 ICAO Doc 8335, Part V, Chapter 4, Paragraph 4.1.2.

177

ñòð.176

With this in mind, all aviation parties bear a major responsibility with regard to safety.
The Dutch Safety Board expects private and public parties in the system to manage
safety (including new risks) as effectively as possible and using the latest technology,
both individually as well as collectively. The nature of this responsibility of the parties
concerned can be compared to that of a duty of care. This means that the parties are
expected to make optimal efforts with regard to civil aviation safety and not exclusively
stick to their strict task description.
The Dutch Safety Board expects states and operators to - at least - comply with legislation
and regulations. With regard to Sections 6 and 7, dealing with the responsibilities of
Ukraine and Malaysia Airlines, the legal frameworks as discussed in Appendix Q represent
a major component of the frame of reference for the investigation conducted by the
Dutch Safety Board. Since the investigation also examines the extent to which the legal
frameworks and their implementation leave room for improvement, the Dutch Safety
Board also adopts its own frame of reference in addition to the legal frameworks.
The general principles of the frame of reference adopted by the Dutch Safety Board
arise from insights from safety science and involve risk inventory and risk assessment and
coping with uncertainty.
4.3.1 Risk inventory and risk assessment
The Dutch Safety Board expects all parties involved - states, operators and international
organisations such as ICAO and EASA - in the spirit of the Chicago Convention, and with
regard to the principles behind ICAO to proactively identify risks and, if necessary, adapt
their safety approach to limit these risks as much as can reasonably be expected. This
means that all the organisations involved shall always take the measures available to
reduce and/or manage the risk, unless these involve demonstrably disproportionately
high costs or other negative consequences. This general principle arises from the
so-called ‘ALARP’ *60 principle, which requires parties involved to consciously and
transparently weigh risks against the effort, time and investments needed to reduce and/
or manage that risk. This principle originated in the feld of external safety and means
that parties that cause risks shall take measures in the context of their social duty of care,
unless they can demonstrate that these measures are disproportionate.
4.3.2 Coping with uncertainty
The Dutch Safety Board expects uncertainty to be the basic point of departure of the
approach adopted by the parties. This means that the parties concerned shall remain
constantly alert and receptive to signals that could indicate the inaccuracy or
incompleteness of earlier assumptions. This requires them to be constantly vigilant with
regard to risks and be prepared to question common assumptions.
---------------------------------------------------------------------------------------------------------------
*60 ALARP: As Low As Reasonably Practicable.

178

ñòð.177

5 THE SITUATION IN THE EASTERN PART OF
UKRAINE AND SIGNALS FOR CIVIL AVIATION

5.1 Introduction

This Section describes information that the Dutch Safety Board found in public and
closed sources, pertaining to the situation in the eastern part of Ukraine during the
period between 1 March and 17 July 2014. Were there events and developments prior to
the crash of flight MH17 that states or operators could have interpreted as signals of a
possible decrease in the safety of the airspace above the area and thus of an increasing
risk to aircraft flying over it? *61
The public sources examined are both primary sources (offcial information from the
Ukrainian State, NOTAMs, ICAO State Letters and EASA safety information bulletins) and
secondary sources, such as newspaper reports, audiovisual media and social media
related for example to security incidents and the possible presence of weapons in the
area.*62 The focus is on primary information, because it is more diffcult to verify the
accuracy of information in news media.
The non-public sources originated from the Dutch intelligence services and the Kingdom
of the Netherlands diplomatic mission in Ukraine. A large part of this information is
indirect, which means it originates from closed briefngs at which (mainly Western)
diplomats, including defence attachés, shared information about political and military
developments in and around the conflict area. It can therefore be assumed that most of
the information that was available to the Dutch services was also available - or could be
available - to the representatives of other Western states. The Dutch Safety Board did
not have access to non-public sources from non-Western states and therefore cannot
make any statements about what information those other states possessed.

5.2 Aeronautical information*63

The Dutch Safety Board examined the extent of the availability of aeronautical information
that could have signalled increasing deterioration of the safety of the airspace above the
eastern part of Ukraine.
In March 2014, the Russian Federation issued NOTAMs for the Simferopol FIR (Crimea), in
which a Russian air traffc service was introduced for the Crimea. Ukraine responded to
--------------------------------------------------------------------------------------------------------------------------------
*61 The information included in this Section is partly based on a study performed by the The Hague Centre for
Strategic Studies (HCSS) at the request of the Dutch Safety Board.
*62 A more detailed description of HCSS’s working method, also with regard to media (including social media), is
included in the report MH17 - About the investigation.
*63 Whenever the Dutch Safety Board mentions NOTAMs, this refers to a selection of NOTAMs that were deemed
relevant. All ‘active’ NOTAMs are included in Appendix D.

179

ñòð.178

this by issuing a NOTAM in which the message from the Russian Federation was rejected
and in which was indicated that Ukraine continued to be responsible for providing air
traffc services in this airspace.
This was followed by more NOTAMs from Ukraine as well as from the Russian Federation.*64
The situation thus created led to the possibility that civil aviation over the area would
receive conflicting instructions, as the various NOTAMs made it clear that there were two
air navigation service providers that both claimed responsibility for air traffc management.
This could present a risk to the safety of air traffc due to possible conflicting instructions.
On 2 April 2014, ICAO published a State Letter in which Member States were informed
of the potential risks to the safety of civil flights in the Simferopol FIR, as a result of the
conflicting instructions: ‘Due to the unsafe situation where more than one ATS provider
may be controlling flights within the same airspace from 3 April 2014, 0600 UTC onwards,
consideration should be given to measures to avoid the airspace and circumnavigate the
Simferopol FIR with alternative routings.’ *65
Also on 2 April, and in response to the ICAO State Letter, the Network Manager at
EUROCONTROL urgently recommended that operators avoid Crimean airspace (the
Simferopol FIR) and select alternative routes.*66 On 3 April 2014, EASA issued a Safety
Information Bulletin (SIB), in which EASA highlighted ICAO’s warning.*67
In the State Letter of 2 April 2014 regarding Simferopol FIR, ICAO also announced that it
would continue to remain active in coordinating all parties regarding any dangers for civil
aviation: ‘ICAO continues to actively coordinate with all involved authorities, international
organisations, airspace users and other states in the region regarding developments as
they unfold, specifcally those which could impact flight safety.’ However, during the
period of 2 April through 17 July 2014, the period during which the armed conflict in the
eastern part of Ukraine broke out and intensifed, ICAO did not mention the situation in
Ukraine again.
The U.S. Federal Aviation Administration (FAA) published FDC NOTAM 4/3635 on
4 March 2014. In this NOTAM, the FAA warned U.S. operators and airmen that were
flying to, from or over Ukraine to be careful in connection with potential instability. From
this information it appeared that there were increasing military activities in Ukraine
airspace and in the area of military aerodromes. Civil aviation could encounter military
activities, particularly in the Crimea region: ‘Potentially hazardous situation - Flight
operations into, out of, within, or over the Ukraine U.S. Operators and airmen should
exercise caution when operating in the Lvov (UKLV), Kyiv (UKBV), Dnepropetrovsk (UKDV),
Odessa (UKOV) and Simferopol (UKFV) flight information regions (FIRs) due to the
potential for instability. Information from the European Emergency Coordination Crisis
Cell and open source media reports indicates there is an increased military presence in
the airspace over Ukraine and in the vicinity of military aerodromes. Civil flight operations
------------------------------------------------------------------------------------------------------------------------------------
*64 These are the following NOTAMs: A0528/14, A0520/14, A0524/14 and A0569/14 from Ukraine and NOTAMs
A0906/14, A0907/14A02, A0907/14B02, A0909/14, A0910/14, A0911/14A02, A0911/14B02, A0912/14 from the
Russian Federation.
*65 ICAO State Letter (EUR/NAT 14-0243.TEC (FOL/CUP)), 2 April 2014.
*66 EUROCONTROL Headline News, 2 April 2014.
*67 EASA Safety Information Bulletin 2014-10, 3 April 2014.

180

ñòð.179

in the Ukraine, particularly in the Crimean region, may be exposed to military activity. U.S.
operators and airmen flying into, out of, within or over the Ukraine must review current
information and NOTAMs, comply with all applicable FAA Regulations and directives and
exercise extreme caution.’ This NOTAM was valid up until 31 March 2014.
The U.S. FAA subsequently issued FDC NOTAM 4/2816 on 3 April 2014. This contained a
flight prohibition imposed on U.S. operators and airmen pertaining to the use of the
airspace above Crimea, the Black Sea and the Sea of Azov. This NOTAM also contained a
warning related to all other Ukrainian FIRs: ‘U.S. operators and airmen flying into, out of,
or within Lvov (UKLV), Kyiv (UKBV), Dneptropetrovsk (UKDV), and Odessa (UKOV) FIRs, as
well as airspace in the Simferopol (UKFV) FIR that is outside the lateral limits of the
airspace over the Crimea, the Black Sea, and the Sea of Azov […] must review current
security/threat information and NOTAMs; comply with all applicable FAA regulations,
operations specifcations, management specifcations, and letters of authorisation,
including updating B450; and exercise extreme caution due to the continuing potential
for instability.’ (Emphasis added by the Dutch Safety Board.)
On 23 April, this was followed by FDC NOTAM 4/7667 (A0012/14), which contained FAA
SFAR 113 and repeated previous prohibitions and warnings, enacting them.*68,*69 The
warning pertaining to the remainder of Ukraine was formulated in general terms and did
not contain any specifc information about the armed conflict and the potential risks it
could present to civil aviation. Therefore, prior to the crash of MH17, no state or
international organisation other than Ukraine issued a specifc safety warning about the
eastern part of Ukraine.
The list of all the relevant NOTAMs published by the Ukrainian authorities makes it clear
that, from mid-March 2014, parts of eastern Ukrainian airspace were regularly closed or
their use was restricted for brief periods of time. The duration of the restrictions varied
from several hours to several days. Restrictions involved, for example, certain training
and exercise areas being activated and thus being closed to civil aviation; use by civil
aviation only being possible with permit, and certain parts of flight routes being closed
up to a particular altitude. The reasons for these restrictions or temporary closures were
not cited. Due to the fact that so-called ‘State aircraft’ were excluded and that exercise
areas are intended for military aircraft, it can be deduced that airspace restrictions were
related to Ukrainian air force activities. From June up to 18 July 2014, an increase can be
observed in the number of published NOTAMs in which the use of parts of the airspace
and air routes over the eastern part of Ukraine was restricted.
On 17 July 2014, the day of the crash of flight MH17, 28 NOTAMs were in force pertaining
to the airspace in the eastern part of Ukraine. Eight of those NOTAMs referred to airspace
restrictions. A number of NOTAMs that specifed a restriction pertained to the airspace
at low altitudes, below 5,000 feet. On 5 June 2014, the Ukrainian authorities published
NOTAM A1255/14 (for the airways) and A1256/14 (for the area) with which they temporarily
-------------------------------------------------------------------------------------------------------------------------------
*68 For an explanation of ‘SFAR’, see Section 12, Abbreviations and Defnitions.
*69 By assigning the NOTAM SFAR status, this NOTAM immediately entered into effect with a legislative status. The
FAA has this option to prevent potential danger to persons and/or aeroplanes.


Âû çäåñü » MH17: êàê è êòî? » Îò÷åòû è äîêëàäû DSB è JIT » Îò÷åò DSB 13.10.15: Crash MH17, 17 July 2014